Today, when downloading software or opening an application, consumers base trust on the issuer or publisher of the software. For example, a consumer may trust MICROSOFT™, and may not trust an unknown issuer. Trust based on the issuer alone, however, does not guarantee that the software is not malicious software (malware). A consumer may accept software that has been cryptographically or digitally signed and/or has a certificate of authenticity (CoA). Digitally signed software, however, can still be malicious. Short of executing a malware detection application on incoming software or prior to execution, consumers, information technology (IT) professionals, developers, and the like, have no mechanism on which to base trust on the software itself.